Hi everyone. 1
Welcome to another video of Expert Malware analysis and reverse engineering course. 2
And in this video we are going to begin with analyzing the attack kill chain phases into much more 3
detail. 4
So the first two phases of the cyber killchain model are Reconnaissance and the Weaponization phase. 5
So this is pretty much the pre-attack phase, where the attacker tries to gather information about the 6
victim. 7
And once information has been gathered they try and create a weaponization stage where they can infect 8
or target their victims. 9
So how to perform passive reconnaissance. 10
So basically what I mean by passive reconnaissance is gathering information about your victim without 11
making any direct communication with them. 12
So this means that I'm not scanning their services. 13
I'm not establishing any form of communication with them. 14
I'm just using open source intelligence or open sources to gather information about my target. 15
So information available online like Google search, Twitter and Linkedin can be one of the sources 16
collecting information about public IP, Web services or the Internet facing services. 17
So a lot of times the companies have their public IPs, web services etc. available in the global repository 18
for example Domain Dossier is one repository where you can just enter the IP address and you can get 19
a lot of information about what services are hosted. 20
What's the range of that IP. 21
You can also get information about their email protection policies and things like that. 22
The other passive reconnaissance activity can be whois and reverse look up. 23
So again this is these two are very popular Unix tools which you can use to basically query your 24
DNS server, to get more information about a given service. Again in this case you are not making any direct 25
connection with your target. 26
You are just collecting information that is publicly available at various sources. 27
Collecting target information like employee e-mails, contact numbers work location etc.. 28
Now if you remember the example that we saw in the previous video where a spam e-mail was delivered 29
to the employee andtha e-mail contained a malicious attachment that had an exploit inside it. 30
So before you can send that e-mail you need to figure out 31
Who do you want to send that email to. 32
This is where passive recon comes into action. 33
You basically try and gather information about the weak points, you try and gather information about 34
users or employees of your target organization and from there, 35
You use that information to build your next stage. Active Reconnaissance is the second activity 36
that the attacker can try and implement. 37
So this involves port scanning and fingerprinting. Now, port scanning is an activity where you pick 38
up an IP address of your target and you scan for all open ports that are there for the given IP address. 39
So what this gets you is information about what services are running on those ports, 40
What version of services are those etc.. 41
Now this is a scanning technique where you're directly making a connection with your target. 42
That's why it's called an active Reconnaissance. 43
Port scanning and fingerprinting can be performed using common tools like Nmap, Dig, nslookup 44
and Maltego. Then you can also run a bunch of dummy tests. 45
For example let's say we all know that if there is a company X Y Z. com then there will be an 46
alias email address as HR@xyz.com or let's say CorporateIT@xyz.com 47
some common email aliases or email groups that should be present in almost all the organizations. 48
It basically consists of all the users which are within the HR group or which are within the IT group. 49
So you can basically run a bunch of tests by sending some sample emails or by sending some dummy emails 50
to those address and see whether they get delivered or not. 51
If you don't get any failure notification back it means that those e-mail addresses actually exist 52
and in the next stage you can actually send you weaponized file. 53
so once Reconnaissance phase has been done, 54
The next step is building the weaponization file. Now choosing the attack vector depends on the information 55
that the attacker gathered in their reconnaissance phase. 56
So in the reconnaissance phase you might have gathered information like email addresses, IP addresses or 57
open ports and word services or holsted on those open ports and things like that. 58
So once you choose your particular attack vector, that's when you're going to decide how you're going 59
to weaponize that. 60
For example, again coming back to the e-mail spam case let's say you figured out a bunch of e-mail IDs 61
of HR professionals of your target organization. 62
You can start crafting of malicious spam e-mail and attaching a malicious file with name as resumes. 63
You can go online and you can see that the organization has posted a bunch of openings online. 64
For example let's say a software developer. You can create an email and add an attachment that this is 65
your resume for the software engineer role. 66
And that's how you can basically craft your own weaponization stage. the weaponized file will also shape the 67
delivery mechanism. 68
So once you are weaponization file has been created. 69
You basically go ahead and deliver it to your particular target so that was a quick introduction about 70
reconnaissance. 71
And weaponization phase. Later on we will start looking into the delivery phase and we'll see how the 72
spam emails basically reach into an organization and how we can for them analyze them. 73
That's it for this video. 74
Thanks a lot.